sqreen 1.8.1-java → 1.8.2-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: b0d21819fc61334f99a9277d24b75cf6a3019aa9
-  data.tar.gz: 6c519d9a9bd3844a3f13e84f5dca8bc8d37e3723
+  metadata.gz: a7d88eb10dd8c68391cac146381b6a011819cf6c
+  data.tar.gz: e965922d7adac842200919bea4861eaf291de2d9
 SHA512:
-  metadata.gz: b9ade91bab2590b8734a471f6178e7cf4442de4f41ddd7a5988b4eabcef4f59e0c8c2da44461aa9102b90a2f6ace3026a239499b6bc140447681ea19521886bd
-  data.tar.gz: 639df4701229c9f58e57c6000e3fc26069d2a6ae86a91295f089851e47e1564d23d819a1eabcf94443ba838126f617276539efe7ad09d11795cb47888710ebd0
+  metadata.gz: 496245abe34c72c16c3653033b7a8667174001de778d55d68cc7ce4f9c06f672dda656203ec4acc7b961fa96e89c8c5feed5901a75ab9ab35f11ddfa70d7bd31
+  data.tar.gz: 421564e3bebc03c43562a3713a27cec7bb8b3ec79769a2af1ddf5b7ff1b1daefe7b3f4e6cd9113e0d6e8924668750ef56dfef5abd993d4d46f9f98d70c89cce2

data/lib/sqreen/condition_evaluator.rb

@@ -30,7 +30,7 @@ module Sqreen
     # @params value [Object] object to find
     # @params hash [Hash] Hash to search into
     # @params min_value_size [Fixnum] to compare against
-    def self.hash_val_include?(value, hash, min_value_size, rem = 10)
+    def self.hash_val_include?(value, hash, min_value_size, rem = 20)
       return true if rem <= 0
       vals = hash
       vals = hash.values if hash.is_a?(Hash)

data/lib/sqreen/frameworks/generic.rb

@@ -64,16 +64,25 @@ module Sqreen
 
       # Sourced from rack:Request#trusted_proxy?
       TRUSTED_PROXIES = /\A127\.0\.0\.1\Z|\A(10|172\.(1[6-9]|2[0-9]|30|31)|192\.168)\.|\A::1\Z|\Afd[0-9a-f]{2}:.+|\Alocalhost\Z|\Aunix\Z|\Aunix:/i
+      LOCALHOST = /\A127\.0\.0\.1\Z|\A::1\Z|\Alocalhost\Z|\Aunix\Z|\Aunix:/i
 
       # What is the current client IP
       def client_ip
         req = request
         return nil unless req
+        # Look for an external address being forwarded
         forwarded = req.env['HTTP_X_FORWARDED_FOR']
         ips = split_ip_addresses(forwarded)
         last = ips.find { |ip| (ip !~ TRUSTED_PROXIES) && valid_ip?(ip) }
         return last unless last.nil?
-        req.env['REMOTE_ADDR']
+        # Else fall back to declared remote addr
+        r = req.env['REMOTE_ADDR']
+        # If this is localhost get the last hop before
+        if !ips.empty? && r =~ LOCALHOST
+          last = ips.find { |ip| (ip !~ LOCALHOST) && valid_ip?(ip) }
+          return last unless last.nil?
+        end
+        r
       end
 
       # Get a header by name

data/lib/sqreen/rules_callbacks/execjs.rb

@@ -9,7 +9,9 @@ end
 
 require 'execjs'
 
+require 'sqreen/rule_attributes'
 require 'sqreen/rule_callback'
+require 'sqreen/condition_evaluator'
 require 'sqreen/binding_accessor'
 require 'sqreen/events/remote_exception'
 
@@ -19,7 +21,8 @@ module Sqreen
     class ExecJSCB < RuleCB
       def initialize(klass, method, rule_hash)
         super(klass, method, rule_hash)
-        callbacks = @rule['callbacks']
+        callbacks = @rule[Attrs::CALLBACKS]
+        @conditions = @rule.fetch(Attrs::CONDITIONS, {})
 
         if callbacks['pre'].nil? &&
            callbacks['post'].nil? &&
@@ -61,6 +64,48 @@ module Sqreen
         call_callback('failing', inst, args, rv)
       end
 
+      def self.hash_val_included(needed, haystack, min_length = 8, max_depth = 20)
+        new_obj = {}
+        insert = []
+        to_do = haystack.map { |k, v| [new_obj, k, v, 0] }
+        until to_do.empty?
+          where, key, value, deepness = to_do.pop
+          safe_key = key.kind_of?(Integer) ? key : key.to_s
+          if value.is_a?(Hash) && deepness < max_depth
+            val = {}
+            insert << [where, safe_key, val]
+            to_do += value.map { |k, v| [val, k, v, deepness + 1] }
+          elsif value.is_a?(Array) && deepness < max_depth
+            val = []
+            insert << [where, safe_key, val]
+            i = -1
+            to_do += value.map { |v| [val, i += 1, v, deepness + 1] }
+          elsif deepness >= max_depth # if we are after max_depth don't try to filter
+            insert << [where, safe_key, value]
+          else
+            v = value.to_s
+            if v.size >= min_length && ConditionEvaluator.str_include?(needed.to_s, v)
+              case where
+              when Array
+                where << value
+              else
+                where[safe_key] = value
+              end
+            end
+          end
+        end
+        insert.reverse.each do |wh, ikey, ival|
+          case wh
+          when Array
+            wh << ival unless ival.empty?
+          else
+            wh[ikey] = ival unless ival.empty?
+          end
+        end
+
+        new_obj
+      end
+
       protected
 
       def record_and_continue?(ret)
@@ -92,6 +137,7 @@ module Sqreen
           arguments = (args_override || @argument_requirements[name]).map do |accessor|
             accessor.resolve(binding, framework, inst, args, @data, rv)
           end
+          arguments = restrict(name, arguments) if @conditions.key?(name)
           Sqreen.log.debug { [name, arguments].inspect }
           ret = @compiled.call(name, *arguments)
           unless record_and_continue?(ret)
@@ -110,6 +156,41 @@ module Sqreen
         nil
       end
 
+      def each_hash_val_include(condition, depth = 10)
+        return if depth <= 0
+        condition.each do |key, values|
+          if key == ConditionEvaluator::HASH_INC_OPERATOR
+            yield values
+          else
+            values.map do |v|
+              each_hash_val_include(v, depth - 1) { |vals| yield vals } if v.is_a?(Hash)
+            end
+          end
+        end
+      end
+
+      def restrict(cbname, arguments)
+        condition = @conditions[cbname]
+        return arguments if condition.nil? or @argument_requirements[cbname].nil?
+
+        each_hash_val_include(condition) do |needle, haystack, min_length|
+          # We could actually run the binding accessor expression here.
+          needed_idx = @argument_requirements[cbname].map(&:expression).index(needle)
+          next unless needed_idx
+
+          haystack_idx = @argument_requirements[cbname].map(&:expression).index(haystack)
+          next unless haystack_idx
+
+          arguments[haystack_idx] = ExecJSCB.hash_val_included(
+            arguments[needed_idx],
+            arguments[haystack_idx],
+            min_length.to_i
+          )
+        end
+
+        arguments
+      end
+
       def build_accessor(reqs)
         reqs.map do |req|
           BindingAccessor.new(req, true)

data/lib/sqreen/version.rb

@@ -1,5 +1,5 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.io/terms.html
 module Sqreen
-  VERSION = '1.8.1'.freeze
+  VERSION = '1.8.2'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sqreen
 version: !ruby/object:Gem::Version
-  version: 1.8.1
+  version: 1.8.2
 platform: java
 authors:
 - Sqreen
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2017-08-09 00:00:00.000000000 Z
+date: 2017-09-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: execjs